<--Back to Newsletter

An online shopper clicks on a sweater. The garment then follows that person around the internet, from site to site. This friendly reminder is tied to a retailer’s targeted advertising using tracking cookies.

Cookies—small text files stored on a user’s browser—assign website visitors with “unique identifiers” that individually track internet use. And while cookies generate significant revenue for companies in the ad tech ecosystem, their use may soon be curtailed by the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GCPR), which consider the unique trackers to be “personal information.”

Privacy advocates argue that websites must allow consumers to opt-out of this tracking once the CCPA takes effect in January 2020. The CCPA requires that businesses provide an opt-out when they sell the personal information of Californians. The definition of “sale” includes “making available” personal information in exchange for money or other “valuable consideration.” Neither the CCPA nor the proposed regulations under the CCPA define what “valuable consideration” means. For privacy advocates, the ability of third parties to place tracking cookies on the browsers of website visitors is tantamount to providing the personal information of Californians. The valuable consideration: participation in the targeted advertising ecosystem, which in its current form relies on tracking cookies to optimize ad placement.

This argument is not universally accepted, and the ad tech community has raised some good arguments against such a reading of the CCPA. For one, many websites don't allow targeted advertising. In these cases, it is difficult to see what valuable consideration the website is receiving in exchange for allowing tracking cookies. The sale of personal information arguably occurs between ad tech companies—such as data aggregators and ad brokers—and not by the website publisher or advertiser. At this stage, these may only be theoretical arguments. There is no clear consensus. The California Attorney General has remained silent on the issue.

Research shows how tracking cookies have benefitted retailers. For example, 26 percent of customers will return to a site through the cookie-fueled advertising method known as retargeting, compared to 8 percent of customers returning without retargeting, according to the consultancy SAP. Now, online retailers with sophisticated digital advertising should consider alternatives if consumers are given the choice to opt out of tracking cookies. One idea is to broaden the scope of advertising so it is not performed on a group, not individual, level. Before the advertising industry could target individuals, they would target groups of people they believe to have similar interests, based on a variety of factors. Contextual advertising—where a website’s content drives advertising decisions—also may be explored as an alternative to individual targeted advertising. Both methods are a less precise way of targeting ads, but adopting these models would arguably preclude a business from being categorized as "selling" personal information.

Neither the CCPA nor the proposed regulations under the CCPA directly address whether the use of tracking cookies requires an opt-out. But even if the final regulations come down on the side of narrowly defining sale in a way that excludes tracking cookies, online retailers may need to prepare for a world where tracking cookies are used less freely. This is particularly true for global companies subject to the GDPR because the currents are clearly moving toward more robust disclosure requirements and an opt-in model for tracking cookies.

As more and more states consider CCPA-like privacy laws, it may only be a matter of time before U.S. states adopt a European view of tracking cookies. Businesses, including online retailers, will need to consider the privacy implications of their digital advertising practices and adjust.

<--Back to Newsletter

Copyright © 2019 by Ballard Spahr LLP.
(No claim to original U.S. government material.)

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, including electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.

This alert is a periodic publication of Ballard Spahr LLP and is intended to notify recipients of new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own attorney concerning your situation and specific legal questions you have.